Documentation
¶
Overview ¶
Package vuln provides stateless helpers for building and parsing the Trivy scanner invocations used by the vulnerability service. Functions here have no dependency on database or service state so they can be unit-tested in isolation.
Index ¶
- Constants
- func BuildContainerConfig(trivyImage string, cmdArgs []string, env []string) *containertypes.Config
- func BuildDockerConfigJSON(authConfigs map[string]dockerregistry.AuthConfig) ([]byte, error)
- func BuildDockerHostEnv(dockerHost string) []string
- func DefaultRepositoryArgs() []string
- func IgnoreUnfixedArgs(enabled bool) []string
- func NormalizeNetworkMode(networkMode string) string
- func ParseDockerHost(dockerHost string) (scheme string, socketPath string, err error)
- func ParseSecurityOpts(value string) []string
- func ParseVersion(output string) string
- func ScanCacheBackendArgs() []string
- func ScanCacheBackendArgsForArch(arch string) []string
- func ScanSourceArgs(serverURL string) []string
- func ServerTokenEnv(token string) []string
Constants ¶
const ( // DefaultDockerHostURI is the fallback Docker endpoint used when none is configured. DefaultDockerHostURI = "unix:///var/run/docker.sock" // DefaultDBRepository / DefaultJavaDBRepository / DefaultChecksBundleRepository are the // Arcane-mirrored Trivy database locations passed to the scanner. DefaultDBRepository = "ghcr.io/getarcaneapp/trivy-db:2" DefaultJavaDBRepository = "ghcr.io/getarcaneapp/trivy-java-db:1" DefaultChecksBundleRepository = "ghcr.io/getarcaneapp/trivy-checks:1" )
Variables ¶
This section is empty.
Functions ¶
func BuildContainerConfig ¶
func BuildContainerConfig(trivyImage string, cmdArgs []string, env []string) *containertypes.Config
BuildContainerConfig assembles the container.Config for a Trivy scan container.
func BuildDockerConfigJSON ¶
func BuildDockerConfigJSON(authConfigs map[string]dockerregistry.AuthConfig) ([]byte, error)
BuildDockerConfigJSON encodes registry auth configs into a docker config.json payload (base64 user:password under each host). It returns (nil, nil) when there are no usable credentials.
func BuildDockerHostEnv ¶
BuildDockerHostEnv returns the DOCKER_HOST environment entry for a non-empty host.
func DefaultRepositoryArgs ¶
func DefaultRepositoryArgs() []string
DefaultRepositoryArgs returns the Trivy DB repository flags pointing at the Arcane-mirrored databases.
func IgnoreUnfixedArgs ¶ added in v2.2.0
IgnoreUnfixedArgs returns --ignore-unfixed when enabled so Trivy only reports vulnerabilities that have a known fix.
func NormalizeNetworkMode ¶
NormalizeNetworkMode trims a configured Trivy network mode.
func ParseDockerHost ¶
ParseDockerHost validates and decomposes a Docker host URI into its scheme and, for unix sockets, the socket path. An empty host falls back to DefaultDockerHostURI.
func ParseSecurityOpts ¶
ParseSecurityOpts splits a comma- or newline-separated list of security options into a cleaned slice, returning nil when there are no non-empty entries.
func ParseVersion ¶
ParseVersion extracts the version string from `trivy --version` output. It returns the value after a "Version:" prefix when present, otherwise the trimmed output as-is.
func ScanCacheBackendArgs ¶
func ScanCacheBackendArgs() []string
ScanCacheBackendArgs returns the cache-backend flags for the running architecture.
func ScanCacheBackendArgsForArch ¶
ScanCacheBackendArgsForArch returns the Trivy cache-backend flags for a GOARCH. The default BoltDB-backed cache can fail with ENOMEM on arm/v7 and 386 because Go's heap reservations fragment the limited 32-bit virtual address space.
func ScanSourceArgs ¶ added in v2.2.0
ScanSourceArgs returns the Trivy flags selecting where vulnerability data comes from. In client/server mode (serverURL set) the client never opens the local BoltDB, so --server replaces the cache-backend and DB-repository flags. This is the supported path on 32-bit hosts (arm/v7) where the local DB cannot be memory-mapped. With an empty serverURL it falls back to the standalone local-database flags. The server token is passed via ServerTokenEnv rather than a flag so it is not exposed in the process arguments.
func ServerTokenEnv ¶ added in v2.2.0
ServerTokenEnv returns the TRIVY_TOKEN environment entry for a non-empty Trivy server token. Passing the token through the environment instead of a --token CLI flag keeps it out of the container's process arguments (/proc/<pid>/cmdline, ps).
Types ¶
This section is empty.
Source Files